Double Free in Google Chrome - CVE-2021-30535

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU53573

Double Free in Google Chrome - CVE-2021-30535

Published: May 25, 2021


Vulnerability identifier: #VU53573
CSH Severity: Medium
CVSS v4: 7.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-30535
CWE-ID: CWE-415
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within ICU component in Google Chrome. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger a double free error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

Google Chrome
Microsoft Edge
Arch Linux
Fedora
Ubuntu
qt5-qtwebengine
icu-devtools (Ubuntu package)
libicu-dev (Ubuntu package)
libicu66 (Ubuntu package)
libicu67 (Ubuntu package)
chromium

How to mitigate CVE-2021-30535

Install updates from vendor's website.

Google Chrome - update to 91.0.4472.77
Microsoft Edge - update to 91.0.864.37
qt5-qtwebengine - update to 5.15.8-2.fc34
icu-devtools (Ubuntu package) - addressed in versions 66.1-2ubuntu2.1, 67.1-6ubuntu2.1
libicu-dev (Ubuntu package) - addressed in versions 66.1-2ubuntu2.1, 67.1-6ubuntu2.1
libicu66 (Ubuntu package) - update to 66.1-2ubuntu2.1
libicu67 (Ubuntu package) - update to 67.1-6ubuntu2.1
chromium - addressed in versions 91.0.4472.114-1.el8, 91.0.4472.114-1.fc33, 91.0.4472.114-1.fc34, 91.0.4472.114-2.el8, 91.0.4472.114-2.fc33, 91.0.4472.164-1.el8

External References

Related Security Bulletins